用可解释性剪枝+结构化压缩，让物联网入侵检测更轻更快。
Lightweight Intrusion Detection in IoT via SHAP-Guided Feature Pruning and Knowledge-Distilled Kronecker Networks
- 先用SHAP找关键特征，再用克罗内克网络压缩模型。
- 模型缩小近1000倍，准确率仍超0.986，响应在毫秒级。
- 适合资源受限的物联网设备部署，兼顾性能与可解释性。
物联网设备的广泛应用要求入侵检测系统具备高精度且满足严格资源约束。传统深度学习检测模型往往过大且计算量高，难以在边缘端部署。本文提出一种轻量级入侵检测系统，结合SHAP引导的特征剪枝与知识蒸馏的克罗内克网络。一个高容量教师模型通过SHAP解释识别出最相关的特征，一个压缩的学生模型利用克罗内克结构层最小化参数量，同时保留判别性输入。知识蒸馏将教师模型的软决策边界传递给学生，提升压缩后的泛化能力。在TON_IoT数据集上的实验表明，学生模型比教师模型小近三个数量级，仍保持宏平均F1超过0.986，推理延迟为毫秒级别。结果表明，可解释性驱动的剪枝与结构化压缩可协同实现可扩展、低延迟、节能的入侵检测系统，适用于异构物联网环境。
原文摘要 · Abstract (English)
The widespread deployment of Internet of Things (IoT) devices requires intrusion detection systems (IDS) with high accuracy while operating under strict resource constraints. Conventional deep learning IDS are often too large and computationally intensive for edge deployment. We propose a lightweight IDS that combines SHAP-guided feature pruning with knowledge-distilled Kronecker networks. A high-capacity teacher model identifies the most relevant features through SHAP explanations, and a compressed student leverages Kronecker-structured layers to minimize parameters while preserving discriminative inputs. Knowledge distillation transfers softened decision boundaries from teacher to student, improving generalization under compression. Experiments on the TON\_IoT dataset show that the student is nearly three orders of magnitude smaller than the teacher yet sustains macro-F1 above 0.986 with millisecond-level inference latency. The results demonstrate that explainability-driven pruning and structured compression can jointly enable scalable, low-latency, and energy-efficient IDS for heterogeneous IoT environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。